Refactor API proxy to use supportsLLMGateway engine flag by Copilot · Pull Request #15557 · github/gh-aw

Copilot · 2026-02-14T01:19:35Z

The API proxy feature was using hardcoded engine checks (workflowData.AI == "claude") instead of leveraging the existing supportsLLMGateway capability flag in the agentic engine architecture.

Changes

Engine configuration: Set supportsLLMGateway: true for Claude, false for Codex/Copilot
Docker image collection (docker.go): Query engine registry and check engine.SupportsLLMGateway() instead of hardcoded string comparison
AWF flag generation (claude_engine.go, codex_engine.go): Conditionally add --enable-api-proxy based on e.SupportsLLMGateway()
Tests: Updated to verify behavior for all three engines

Before/After

// Before: Hardcoded engine check
if workflowData != nil && workflowData.AI == "claude" {
    apiProxyImage := constants.DefaultFirewallRegistry + "/api-proxy:" + awfImageTag
    // ...
}

// After: Capability-based check
if workflowData != nil && workflowData.AI != "" {
    registry := GetGlobalEngineRegistry()
    engine, err := registry.GetEngine(workflowData.AI)
    if err == nil && engine.SupportsLLMGateway() {
        apiProxyImage := constants.DefaultFirewallRegistry + "/api-proxy:" + awfImageTag
        // ...
    }
}

The api-proxy sidecar proxies LLM API calls through the firewall (port 10000 for OpenAI, port 10001 for Anthropic) and is now conditionally enabled based on engine capabilities rather than engine identity.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

…pi-proxy flag - Set Claude engine supportsLLMGateway: true - Set Codex engine supportsLLMGateway: false - Refactor docker.go to check engine's supportsLLMGateway flag instead of hardcoded engine name - Refactor claude_engine.go to conditionally add --enable-api-proxy based on supportsLLMGateway - Add same conditional logic to codex_engine.go for future LLM gateway support - Update tests to verify behavior for all engines Co-authored-by: pelikhan <[email protected]>

Copilot · 2026-02-14T01:28:41Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ine supportsLLMG/opt/hostedtoolcache/node/24.13.0/x64/bin/npx (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw ine supportsLLMG-c (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v2 --jq .object.sha (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/11bd71901bbe5b1630ceea73d27597364c9af683 --jq .object.sha (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha rd .cfg 64/pkg/tool/linux_amd64/vet credential.userngit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha rd .cfg 64/pkg/tool/linux_amd64/vet credential.userninfocmp (http block)
https://api.github.com/repos/actions/download-artifact/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha ./../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore origin ps (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v6 --jq .object.sha set-url origin de/node/bin/bash (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v7
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha rd .cfg 64/pkg/tool/linux_amd64/vet credential.userninfocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v7 --jq .object.sha on' --ignore-path ../../../.pret.prettierignore .cfg odules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node user.name (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/4dc6199c7b1a012772edbd06daecab0f50c9053c --jq .object.sha on' --ignore-pat-f .cfg ndor/bin/bash user.name (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha w/js/**/*.json' --ignore-path (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v5 --jq .object.sha w/js/**/*.json' --ignore-path ../../../.prettierignore (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha ignore-path ../../../.prettierignore e x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v6 --jq .object.sha ." image and --enable-api-proxy fl-ifaceassert 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha ignore-path ../../../.prettierignore e x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha pkg/workflow/data/action_pins.json; \ echo "�� Action pins synced successfully"; \ else \ echo "�� Warning: .github/aw/actions-lock.json does not exist yet"; \ fi ble-api-proxy fl-ifaceassert x_amd64/vet (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha ath ../../../.pr**/*.json (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v6 --jq .object.sha ath ../../../.prettierignore (http block)
https://api.github.com/repos/anchore/sbom-action/git/ref/tags/v0
- Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha on' --ignore-path ../../../.prettierignore .cfg 64/pkg/tool/linux_amd64/vet credential.userninfocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha on' --ignore-pat-f ts_inputs_test.gowner=github 64/pkg/tool/linu-f credential.userngit (http block)
- Triggering command: /usr/bin/gh gh api /repos/anchore/sbom-action/git/ref/tags/v0 --jq .object.sha on' --ignore-pat-f --local 64/pkg/tool/linu-f user.email (http block)
https://api.github.com/repos/docker/build-push-action/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha 5533 .cfg 64/pkg/tool/linu-f credential.userngit (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha on' --ignore-path ../../../.pret.prettierignore .cfg $name) { hasDiscussionsEnabled } } user.name (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/build-push-action/git/ref/tags/v6 --jq .object.sha on' --ignore-path ../../../.prettierignore --local sh user.email (http block)
https://api.github.com/repos/docker/login-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha on' --ignore-path ../../../.pret.prettierignore .cfg node user.name (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq .object.sha on' --ignore-path ../../../.prettierignore .cfg 64/pkg/tool/linux_amd64/cgo user.email (http block)
https://api.github.com/repos/docker/metadata-action/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha on' --ignore-pat-f .cfg 0/x64/bin/bash user.name (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/metadata-action/git/ref/tags/v5 --jq .object.sha on' --ignore-path ../../../.prettierignore .cfg _modules/.bin/sh user.email (http block)
https://api.github.com/repos/docker/setup-buildx-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha rd .cfg r: $owner, name: $name) { hasDiscussionsEnabled } } credential.userninfocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha on' --ignore-path ../../../.pret.prettierignore .cfg _modules/.bin/node user.name (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/setup-buildx-action/git/ref/tags/v3 --jq .object.sha on' --ignore-path ../../../.prettierignore .cfg ode_modules/.bin/sh user.name (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/c4e091835c7a94dc7d3acb8ed3ae145afb4995f3 --jq .object.sha h ../../../.prettierignore (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha (http block)
https://api.github.com/user
- Triggering command: /usr/bin/gh gh api user --jq .login ignore-path ../../../.prettierignore e x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

This PR refactors the API proxy feature to use the supportsLLMGateway engine capability flag instead of hardcoded engine name checks. The api-proxy is a sidecar container that securely holds LLM API keys and proxies requests through the firewall.

Changes:

Set supportsLLMGateway: true for Claude engine (enabling api-proxy), and false for Codex engine (disabling api-proxy)
Refactored docker.go to query the engine registry and check SupportsLLMGateway() instead of hardcoding workflowData.AI == "claude"
Updated engine execution steps to conditionally add --enable-api-proxy flag based on SupportsLLMGateway() capability
Added test coverage for all three engines (Claude, Copilot, Codex)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/enable_api_proxy_test.go	Updated test descriptions and added Codex test case to verify engines without LLM gateway support don't include the `--enable-api-proxy` flag
pkg/workflow/docker_api_proxy_test.go	Updated test name and descriptions, added Codex test case to verify api-proxy image is not collected for engines without LLM gateway support
pkg/workflow/docker.go	Refactored to use `engine.SupportsLLMGateway()` instead of hardcoded engine check, updated comments to reflect capability-based approach
pkg/workflow/codex_engine.go	Set `supportsLLMGateway: false` and added conditional logic to check flag before adding `--enable-api-proxy`
pkg/workflow/claude_engine.go	Set `supportsLLMGateway: true` and wrapped existing `--enable-api-proxy` logic in conditional check

Comments suppressed due to low confidence (1)

pkg/workflow/codex_engine.go:44

The test file pkg/workflow/strict_mode_llm_gateway_test.go also needs to be updated to reflect the new LLM gateway configuration. Currently, that test expects Codex to support LLM gateway (line 306: expectedLLMGateway: true) and Claude to not support it (line 316: expectedLLMGateway: false), which is the opposite of the changes in this PR. The test descriptions throughout that file also reference "codex engine with LLM gateway support" and "claude engine without LLM gateway support", which will now be incorrect.

			supportsLLMGateway:     false, // Codex does not support LLM gateway

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-14T01:38:08Z

pkg/workflow/docker.go

+		//   - Port 10000: OpenAI API proxy (for Codex)
 		//   - Port 10001: Anthropic API proxy (for Claude)


The comment mentions "Port 10000: OpenAI API proxy (for Codex)" but Codex has been configured with supportsLLMGateway: false in this PR, meaning it won't use the api-proxy. This comment should be updated to reflect that only Claude currently uses the api-proxy, or the comment should clarify that Port 10000 is available for future use but not currently utilized by Codex.

Suggested change

// - Port 10000: OpenAI API proxy (for Codex)

// - Port 10001: Anthropic API proxy (for Claude)

// - Port 10000: OpenAI API proxy (reserved for future use; Codex does not currently use the LLM gateway)

// - Port 10001: Anthropic API proxy (for Claude; currently the only engine using the LLM gateway)

Copilot · 2026-02-14T01:38:09Z

pkg/workflow/codex_engine.go

+		// Enable API proxy sidecar if this engine supports LLM gateway
+		// The api-proxy container holds the LLM API keys and proxies requests through the firewall
+		if e.SupportsLLMGateway() {
+			awfArgs = append(awfArgs, "--enable-api-proxy")
+			codexEngineLog.Print("Added --enable-api-proxy for LLM API proxying")
+		}
+


The conditional check if e.SupportsLLMGateway() will always be false for Codex since supportsLLMGateway is set to false at line 44. This means the --enable-api-proxy flag will never be added for Codex. While this appears intentional based on the configuration change, this entire conditional block (lines 250-255) is now unreachable dead code for the Codex engine and could be removed for clarity. Alternatively, if Codex is intended to support LLM gateway in the future, the configuration at line 44 should be changed to true.

This issue also appears on line 44 of the same file.

Suggested change

// Enable API proxy sidecar if this engine supports LLM gateway

// The api-proxy container holds the LLM API keys and proxies requests through the firewall

if e.SupportsLLMGateway() {

awfArgs = append(awfArgs, "--enable-api-proxy")

codexEngineLog.Print("Added --enable-api-proxy for LLM API proxying")

}

* Enable --enable-api-proxy for Claude and Codex engines, pre-pull api-proxy image The AWF api-proxy sidecar securely holds LLM API keys and proxies requests through the firewall. It exposes two endpoints: - Port 10000: OpenAI API proxy (for Codex) - Port 10001: Anthropic API proxy (for Claude) Changes: - claude_engine.go: Add --enable-api-proxy to AWF args when firewall is enabled - codex_engine.go: Add --enable-api-proxy to AWF args when firewall is enabled - docker.go: Pre-pull ghcr.io/github/gh-aw-firewall/api-proxy image for Claude and Codex engines (required because --skip-pull is used) - Add unit tests for docker image collection and engine flag generation - Recompile all workflow lock files Fixes the smoke-claude failure where AWF tried to start the api-proxy container but the image wasn't pre-pulled: Container awf-api-proxy Error response from daemon: No such image: ghcr.io/github/gh-aw-firewall/api-proxy:0.16.5 Note: The api-proxy Docker image must also be published to GHCR via the gh-aw-firewall release workflow before smoke tests will pass. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Bump DefaultFirewallVersion to v0.17.0 v0.17.0 includes the api-proxy container image in the release pipeline, which is required for --enable-api-proxy to work with --skip-pull. Recompiled all 150 workflow lock files to reference v0.17.0 images. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> * Update frontmatter hash and correct GitHub domain in allowed domains list * [WIP] Enable --enable-api-proxy for Claude and Codex engines (#15550) * Initial plan * Revert Codex API proxy changes - Remove --enable-api-proxy flag from codex_engine.go - Update docker.go to exclude Codex from API proxy image collection - Remove Codex test case from enable_api_proxy_test.go - Remove Codex test case from docker_api_proxy_test.go - Recompile workflows: smoke-codex, codex-github-remote-mcp-test, changeset Co-authored-by: pelikhan <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: pelikhan <[email protected]> * Refactor download container images command to remove api-proxy from multiple workflows * Refactor API proxy to use supportsLLMGateway engine flag (#15557) * Initial plan * Use supportsLLMGateway flag to control api-proxy image and --enable-api-proxy flag - Set Claude engine supportsLLMGateway: true - Set Codex engine supportsLLMGateway: false - Refactor docker.go to check engine's supportsLLMGateway flag instead of hardcoded engine name - Refactor claude_engine.go to conditionally add --enable-api-proxy based on supportsLLMGateway - Add same conditional logic to codex_engine.go for future LLM gateway support - Update tests to verify behavior for all engines Co-authored-by: pelikhan <[email protected]> * Apply formatting to claude_engine.go --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: pelikhan <[email protected]> --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: Peli de Halleux <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: pelikhan <[email protected]>

Initial plan

1e2a706

Copilot AI assigned Copilot and pelikhan Feb 14, 2026

Copilot AI mentioned this pull request Feb 14, 2026

Enable --enable-api-proxy for Claude and Codex engines #15533

Merged

6 tasks

Copilot started work on behalf of pelikhan February 14, 2026 01:19 View session

Copilot AI and others added 2 commits February 14, 2026 01:26

Apply formatting to claude_engine.go

f169d38

Copilot AI changed the title ~~[WIP] Enable --enable-api-proxy for Claude and Codex engines~~ Refactor API proxy to use supportsLLMGateway engine flag Feb 14, 2026

Copilot AI requested a review from pelikhan February 14, 2026 01:28

Copilot finished work on behalf of pelikhan February 14, 2026 01:28

pelikhan marked this pull request as ready for review February 14, 2026 01:33

Copilot AI review requested due to automatic review settings February 14, 2026 01:33

pelikhan merged commit 964b2be into fix/enable-api-proxy-codex-claude Feb 14, 2026

pelikhan deleted the copilot/sub-pr-15533 branch February 14, 2026 01:33

Copilot started reviewing on behalf of pelikhan February 14, 2026 01:34 View session

Copilot AI reviewed Feb 14, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 14, 2026

Smoke Test: Copilot - 22008679404 #15563

Closed

This was referenced Feb 14, 2026

Smoke Test: Claude - 22008835344 #15567

Closed

[CI Failure Doctor] Engine LLM gateway flags mismatch causing strict-mode tests to fail #15568

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refactor API proxy to use supportsLLMGateway engine flag#15557

Refactor API proxy to use supportsLLMGateway engine flag#15557
pelikhan merged 3 commits intofix/enable-api-proxy-codex-claudefrom
copilot/sub-pr-15533

Copilot AI commented Feb 14, 2026 •

edited

Loading

Uh oh!

Copilot AI commented Feb 14, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 14, 2026

Uh oh!

Copilot AI Feb 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		// - Port 10000: OpenAI API proxy (for Codex)
		// - Port 10001: Anthropic API proxy (for Claude)

Conversation

Copilot AI commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Before/After

Uh oh!

Copilot AI commented Feb 14, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 14, 2026 •

edited

Loading